Binance begins recovering assets after North Korean hackers drain $6.36 billion

Binance began recovering assets for users on Friday following a massive hack that drained approximately $6.36 billion from the exchange's wallets.

The world's largest cryptocurrency exchange stated that it will cover all losses from the incident. It suspended withdrawals on Thursday and expects to resume the feature within the next day or two. Deposits remained unaffected during the disruption.

A U.S.-based blockchain intelligence firm, TRM, attributed the attack to a North Korean unit known as TraderTraitor. The firm said it made this judgment with high confidence in a post on its website Thursday.

TRM reported that the attacker moved the funds across ten different blockchains. Most of the money was transferred in about 20 minutes. This theft stands as the largest cryptocurrency heist on record, according to TRM.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by the Democratic People's Republic of Korea group TraderTraitor.

Binance said its initial investigation suggested a compromised laptop was involved. A subsequent review uncovered additional points of breach. The company stated it found no evidence of any wallet private key leak. It plans to release more technical details when its probe is complete.

Cybersecurity experts point to specific technical weaknesses in the attack. Kok Tin Gan, cofounder and CEO of NyxLab, said the incident appears to involve a single signature that granted the attacker a never-expiring, full-access token to a hot wallet. Hot wallets hold users' private keys and are connected to the internet.

Binance worked with blockchain partners to freeze roughly $3 billion in affected assets. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. The exchange has not publicly confirmed the North Korean link but acknowledged the ongoing investigation.

This attack follows a similar incident in February 2025, when the exchange Bybit lost $1.5 billion to a hack. The FBI said North Korea and TraderTraitor were responsible for that breach. TRM noted that several features of the Binance attack match those earlier North Korea-linked heists.

North Korea has increasingly turned to crypto hacking to generate foreign currency. The funds help support its economy and nuclear program amid tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen $1.1 billion in digital assets over the previous five years.

Changpeng Zhao, who founded Binance in 2017, commented on the breach on X on Thursday. He stated that user funds are safe and that the theft looks like a hack on the platform. Zhao, who no longer manages the company, said he expects all user funds to be fully covered as a shareholder. He pleaded guilty to a felony in 2023 related to money laundering on the platform and received a presidential pardon in 2025.